fix(plugins): Python plugins see the host document again

Plugins read the host's document through a shared reference across the
dynamic-library boundary, and the entity index hashed with foldhash's
per-process seed, so every handle lookup from the plugin missed. The
codec now uses a fixed hasher (opencadcodec f385f75; kernel 9841749,
graph e9c23ad).

The Python IPC suite also caught up with intended changes: ATTDEF
renders its tag, DXF now keeps the lock-position flag, and the modify
audit turns associative arrays off since it checks loose copies.
The rate-limiter test waits for the host's check instead of a fixed
sleep that raced on macOS, and ENV_LOCK no longer cascades a poisoned
lock into every later test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ocs_plugin_api/src/process.rs

@@ -1497,7 +1497,7 @@ mod timeout_tests {
 
     #[test]
     fn runner_handshake_correct_token_is_accepted() {
-        let _guard = ENV_LOCK.lock().unwrap();
+        let _guard = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         std::env::remove_var("OCS_PLUGIN_MAX_API_VERSION");
         let result = verify_runner_handshake(
             RunnerHandshake::Token("correct-token".to_string()),
@@ -1512,7 +1512,7 @@ mod timeout_tests {
 
     #[test]
     fn runner_handshake_tokenv4_selects_v4_path() {
-        let _guard = ENV_LOCK.lock().unwrap();
+        let _guard = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         std::env::remove_var("OCS_PLUGIN_MAX_API_VERSION");
         let result = verify_runner_handshake(
             RunnerHandshake::TokenV4 {
@@ -1530,7 +1530,7 @@ mod timeout_tests {
 
     #[test]
     fn runner_handshake_tokenv4_mismatched_version_is_rejected() {
-        let _guard = ENV_LOCK.lock().unwrap();
+        let _guard = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         std::env::remove_var("OCS_PLUGIN_MAX_API_VERSION");
         let result = verify_runner_handshake(
             RunnerHandshake::TokenV4 {
@@ -1547,7 +1547,7 @@ mod timeout_tests {
 
     #[test]
     fn runner_handshake_tokenv4_rejected_when_v4_disabled() {
-        let _guard = ENV_LOCK.lock().unwrap();
+        let _guard = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         std::env::set_var("OCS_PLUGIN_MAX_API_VERSION", "3");
         let result = verify_runner_handshake(
             RunnerHandshake::TokenV4 {